DEV Community: ADEEL ABBAS

Building an Edge-Native Biometric Redaction Pipeline with Cloudinary

ADEEL ABBAS — Fri, 02 Oct 2026 05:14:43 +0000

Most developers recognize Cloudinary as the premier platform for image hosting, responsive breakpoints, and automated format optimization (f_auto,q_auto). But treating Cloudinary solely as a media asset CDN underutilizes one of its most powerful capabilities: edge-native programmable media as a compliance and privacy engine.

When building modern KYC, onboarding, or regulatory workflows, organizations routinely ingest identity documents (passports, driver's licenses, employee badges). While verification teams only need names and document numbers, unredacted facial biometrics are frequently stored across internal databases, creating severe GDPR, CCPA, and Zero-Trust liabilities.

To solve this, I built VeriScrub (GitHub), a production-grade application that turns Cloudinary into an automated, zero-storage visual PII redaction pipeline.

The Media Problem: Why Traditional Redaction Fails

Handling document sanitization on self-hosted infrastructure presents serious operational hurdles:

Heavy Compute Overhead: Running OpenCV, Sharp, or ImageMagick inside containerized backend runtimes causes CPU throttling, high memory spikes, and concurrency bottlenecks under burst uploads.
Biometric Data Exposure: Passing raw images through backend application memory risks exposing sensitive biometrics in server logs, crash dumps, and unencrypted disk caches.
Secret Leakage Risks: Direct client-to-cloud uploads often tempt developers into exposing master API secrets inside frontend code.

Cloudinary solves this natively by combining asymmetric cryptographic request signing with real-time AI computer vision transformations executed entirely at the edge.

                      [ User Browser ]
                             │
     1. Request Signed Token │  ▲ 4. Receive Dynamic
        (Folder / Timestamp) │  │    Transformed Asset URLs
                             ▼  │
               [ Next.js API: /api/sign-intake ]
                             │
                             │ (HMAC-SHA1 Signature Generation)
                             ▼
              [ Cloudinary Edge / Pipeline ]
                             ▲
                             │ 2. Direct Multipart Form Upload
                             │    (Zero Local Server Storage)
                      [ User Browser ]
                             │
                             ▼ 3. Real-Time Vision Processing
             [ e_blur_faces / e_pixelate_faces ]

1. Zero-Storage Ingest via Cloudinary Signed Uploads

VeriScrub ensures raw biometrics never touch web application servers. Instead of sending media files through Next.js API routes, the browser requests a cryptographic signature bound to strict upload parameters using Cloudinary's Node.js SDK:

// app/api/sign-intake/route.ts
import { NextResponse } from 'next/server';
import { v2 as cloudinary } from 'cloudinary';

cloudinary.config({
  cloud_name: process.env.CLOUDINARY_CLOUD_NAME,
  api_key: process.env.CLOUDINARY_API_KEY,
  api_secret: process.env.CLOUDINARY_API_SECRET,
});

export async function POST() {
  const timestamp = Math.round(new Date().getTime() / 1000);
  const folder = 'veriscrub_quarantine';

  // Generate an HMAC-SHA1 signature locked to this folder and timestamp
  const signature = cloudinary.utils.api_sign_request(
    { timestamp, folder },
    process.env.CLOUDINARY_API_SECRET!
  );

  return NextResponse.json({
    signature,
    timestamp,
    folder,
    apiKey: process.env.CLOUDINARY_API_KEY,
    cloudName: process.env.CLOUDINARY_CLOUD_NAME,
  });
}

The browser receives this single-use signature and dispatches a multipart upload directly to https://api.cloudinary.com/v1_1/${cloudName}/image/upload.

The result: Master API secrets stay secure on the server, while the client uploads directly to an isolated intake folder without exposing backend infrastructure.

2. Dynamic Computer Vision at the Edge

Once Cloudinary ingests the document and assigns an immutable public_id, VeriScrub does not perform any manual pixel manipulation. Instead, it leverages Cloudinary’s transformation URL parameters to trigger facial detection models on the fly:

// lib/pipeline.ts
export function buildDocumentPipeline(cloudName: string, publicId: string) {
  const baseUrl = `https://res.cloudinary.com/${cloudName}/image/upload`;

  return {
    // 1. Optimized Raw Asset (auto format & quality compression)
    rawOptimized: `${baseUrl}/f_auto,q_auto/${publicId}`,

    // 2. High-Strength Gaussian Blur on Detected Faces
    auditBlurred: `${baseUrl}/e_blur_faces:1000/f_auto,q_auto/${publicId}`,

    // 3. Mosaic Pixelation Mask
    auditPixelated: `${baseUrl}/e_pixelate_faces:35/f_auto,q_auto/${publicId}`,

    // 4. Scanner Forensics Mode (sharpen text while keeping biometrics masked)
    scannerContrast: `${baseUrl}/e_blur_faces:1000/e_contrast:30/e_sharpen:100/f_auto,q_auto/${publicId}`,
  };
}

Deep Dive into Cloudinary's Transformation Magic:

e_blur_faces:1000: Cloudinary automatically locates facial coordinate bounding boxes across ID cards and applies an intensive 1000-radius Gaussian blur, eradicating iris patterns and facial contour geometry while keeping document borders legible.
e_pixelate_faces:35: Applies a mosaic grid over facial regions, neutralizing adversarial AI deconvolution algorithms that attempt to reverse-engineer blurred imagery.
e_contrast:30/e_sharpen:100: Enhances high-frequency microprint, ID card serial numbers, and OCR fields so automated text parsers can process documents cleanly while the biometric region stays obscured.

3. Real-Time Inspection & Direct Blob Downloads

VeriScrub features a dual-layer split slider that synchronizes Cloudinary's raw baseline (f_auto,q_auto) and the redacted transformation variant in real time:

<div className="relative w-full aspect-[16/10] overflow-hidden rounded-xl border border-slate-800 bg-slate-950">
  {/* Cloudinary Redacted Variant */}
  <img src={getCurrentUrl()} alt="Redacted document" className="absolute inset-0 w-full h-full object-contain" />

  {/* Raw Image Layer with Dynamic Clipping */}
  <div className="absolute inset-0 overflow-hidden" style={{ width: `${sliderPos}%` }}>
    <img src={results.rawOptimized} alt="Raw document" className="absolute inset-0 w-full h-full object-contain max-w-none" />
  </div>

  <input
    type="range"
    min="0"
    max="100"
    value={sliderPos}
    onChange={(e) => setSliderPos(Number(e.target.value))}
    className="absolute inset-0 opacity-0 cursor-ew-resize w-full h-full z-20"
  />
</div>

To export the sanitized document locally without intermediate backend proxying, VeriScrub streams the Cloudinary CDN response directly into an in-memory client blob:

const handleDownload = async () => {
  const response = await fetch(getCurrentUrl());
  const blob = await response.blob();
  const blobUrl = window.URL.createObjectURL(blob);

  const link = document.createElement('a');
  link.href = blobUrl;
  link.download = `sanitized_${activeTab}_document.jpg`;
  link.click();
  window.URL.revokeObjectURL(blobUrl);
};

What Cloudinary Unlocks for Privacy Engineering

URL-Driven Security: Instead of spinning up containerized image processing workers, Cloudinary allows developers to express complex privacy rules declaratively through simple URL transformation chains.
Zero Compute Overhead: Facial detection and multi-stage transformations execute in sub-seconds across Cloudinary's distributed edge infrastructure.
Resilient Compliance Architecture: By combining signed uploads with short-lived retention policies on intake folders, organizations can achieve true Zero-Trust media ingestion with minimal codebase complexity.

Project Links

🌐 Live Demo: https://veriscrub.vercel.app
📂 GitHub Repository: https://github.com/adeelabbas1214/veriscrub

How are you leveraging Cloudinary's dynamic transformations beyond standard asset optimization? Let's discuss in the comments below!

Share your thoughts/suggestions 🙂

ADEEL ABBAS — Fri, 02 Jan 2026 16:42:33 +0000

ADEEL ABBAS

Dec 31 '25

Automated Reporting System

#aws #lambda #s3 #awscommunitybuilder

3 min read

[Boost]

ADEEL ABBAS — Thu, 01 Jan 2026 06:22:03 +0000

ADEEL ABBAS

Dec 31 '25

Automated Reporting System

#aws #lambda #s3 #awscommunitybuilder

3 min read

Automated Reporting System

ADEEL ABBAS — Wed, 31 Dec 2025 15:49:13 +0000

Overview
We’ll build a system using AWS Lambda and other serverless tools to automate daily reporting. The system will:

Collect data from multiple sources.
Generate a PDF report.
Send the report via email.
Trigger this process daily.

This guide assumes you have a basic understanding of AWS. Let’s start!

Step 1: Create an S3 Bucket

Go to the S3 service.
Click Create bucket.
Name your bucket (e.g., daily-reports-s3-bucket).
Keep other settings default and click Create.
This bucket will store the reports if needed.

Step 2: Verify an Email Address in SES

Go to Amazon SES.
Navigate to Email Addresses under Identity Management.
Click Verify a New Email Address and enter your email.
Check your email inbox and click the verification link.

This allows SES to send emails from this address.

Step 3: Write the Lambda Function

Go to AWS Lambda and click the Create function.
Choose:

Author from scratch.
Function name: daily-report-lambda.
Runtime: Python 3.9 (or later).
Click the Create function.

Code for the Lambda Function

Scroll to the Code section.
Replace the default code with the following:

import boto3
from fpdf import FPDF
import os
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.mime.base import MIMEBase
from email import encoders

def lambda_handler(event, context):
    try:
        # Generate the PDF report
        pdf = FPDF()
        pdf.add_page()
        pdf.set_font("Arial", size=12)
        pdf.cell(200, 10, txt="Daily Report", ln=True, align="C")
        pdf.cell(200, 10, txt="This is your automated report.", ln=True)

        # Save the PDF
        report_path = "/tmp/daily_report.pdf"
        pdf.output(report_path)

        # Upload to S3 (Optional)
        s3 = boto3.client('s3')
        bucket_name = "daily-reports-s3-bucket"
        s3.upload_file(report_path, bucket_name, "daily_report.pdf")

        # Send email via SES with attachment using raw email
        ses = boto3.client('ses')
        msg = MIMEMultipart()
        msg['From'] = "sender_email@gmail.com"  # Replace with your SES verified email
        msg['To'] = "receiver_email@gmail.com"  # Replace with recipient email
        msg['Subject'] = "Daily Report"

        # Attach the text body
        body = MIMEText("Please find the attached report.", 'plain')
        msg.attach(body)

        # Attach the PDF report
        with open(report_path, 'rb') as file:
            part = MIMEBase('application', 'octet-stream')
            part.set_payload(file.read())
            encoders.encode_base64(part)
            part.add_header('Content-Disposition', f'attachment; filename={os.path.basename(report_path)}')
            msg.attach(part)

        # Send the email using SES's send_raw_email
        response = ses.send_raw_email(
            Source=msg['From'],
            Destinations=[msg['To']],
            RawMessage={'Data': msg.as_string()}
        )

        return {"status": "success", "response": response}

    except Exception as e:
        return {"status": "error", "message": str(e)}

Step 4: Install Libraries Locally and Deploy (Optional)

You will use third-party libraries like fpdf, as fpdf is not available in Lambda, package them locally:
Install fpdf locally:

pip install fpdf
Zip the files and upload them to the Lambda function.

Step 5: Set Up EventBridge Trigger

Go to EventBridge.
Click Create rule.
Name: daily-report-trigger.
Define pattern: Schedule.
Cron expression: "cron(0 9 * * ? *)" (9:00 AM UTC daily).
Under Target, choose your Lambda function (daily-report-lambda).
Click Create.

Step 6: Test the Lambda Function

Go to the Test tab in your Lambda function.
Create a new test event (leave it blank).
Click Test.
Check your email inbox for the report.

Complete!

You’ve built a serverless reporting system! 🎉

Happy Cloud Learning

Adeel Abbas

[Boost]

ADEEL ABBAS — Sun, 28 Dec 2025 10:56:41 +0000

ADEEL ABBAS

Dec 25 '25

Restrict IAM User Access after AWS Budget Limit is reached

#lambda #aws #iam #awsbilling

2 min read

Restrict IAM User Access after AWS Budget Limit is reached

ADEEL ABBAS — Thu, 25 Dec 2025 11:27:16 +0000

💰 Automatically Restrict IAM User Access After AWS Budget Limit is Reached

At 2:37 AM, the AWS bill silently crossed its limit, no alarms, no humans watching.
Seconds later, an unseen Lambda woke up, and just like that, the IAM user’s access vanished mid-click.
The cloud didn’t crash, it locked the door 🔒

🎯Goal

Set a spend limit (budget) in AWS.
Send an alert using Amazon SNS when the limit is reached.
Trigger an AWS Lambda function that will restrict an IAM user.
The IAM user will lose AWS access automatically when the budget is exceeded.

✅ Prerequisites

Basic AWS Account
IAM user to test
IAM permissions to create budgets, Lambda functions, and SNS topics

🔧 Step 1: Create an AWS Budget

Go to the AWS Console, choose Billing, then Budgets.
Click Create Budget name: Cost Budget.
Spend limit (let $10 per month).
Add an alert threshold at 100% of the budget.
Create a new SNS Topic when prompted (we'll configure later).

🛠️ Example:

Budget: $10/month
Alert at: 100%

🔔 Step 2: Create an SNS Topic

Go to Amazon SNS choose Topics then Create Topic.
Choose Standard Topic.
Set the name (let: BudgetExceedTopic).
Click Create Topic.
Subscribe Lambda to SNS
We will will link this SNS topic to a Lambda function in the next step.

🖥️ Step 3: Create a Lambda Function

Go to Lambda → Create Function → Author from scratch.
Function name: RestrictIAMUserFunction
Runtime: Python 3.12 (or latest)

Paste This Code:

import boto3
import json

iam = boto3.client('iam')

def lambda_handler(event, context):
    user_name = 'adeel'  # Change this to your IAM username

    deny_policy = {
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*"
        }]
    }

    iam.put_user_policy(
        UserName=user_name,
        PolicyName='DenyAllPolicy',
        PolicyDocument=json.dumps(deny_policy)
    )

    return {"status": f"Permissions restricted for user {user_name}"}

🔒 Step 4: Add IAM Permissions to Lambda

The Lambda needs permissions to:
Write logs
Attach IAM policies Inline Policy to Add:

👉 Replace YOUR_ACCOUNT_ID With your AWS Account ID.
If you want to restrict all users, use:
"Resource": "arn:aws:iam::YOUR_ACCOUNT_ID:user/*"

🔗 Step 5: Connect SNS to Lambda

Go to your SNS Topic, choose Subscriptions, then Create Subscription.
Choose Protocol: AWS Lambda.
Choose the Lambda function we just created.
Confirm subscription.

✔️ Now, when the budget threshold is exceeded, SNS will automatically trigger the Lambda function.

✅ Step 6: Review and Test

Budget Alerts should now trigger your SNS topic when the budget is crossed.
SNS will trigger the Lambda function.
Lambda will restrict the IAM user by attaching a deny-all policy.

✔️ You can verify this by checking the user in IAM ( Inline Policies )

🔥 Key Tips

AWS Budgets update a few times a day, so the restriction is not instant, but timely.
Always test on a non-production user first.
You can enhance this by making the Lambda dynamically read the username from the SNS message.

✨ Happy Cloud Learning!

If you found this blog helpful, Subscribe here:
CloudTipsByAD